Re: Using TCP encapsulation to bypass firewalls

Author	All Replies
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL ·AT&T Midwest	reply to EGeezer Re: Using TCP encapsulation to bypass firewalls But, by employing a little-known implementation of TCP/IP, they can use simple HTTP to encapsulate TCP connection requests. How well is that going to work, if your only HTTP access is through a caching proxy server? -- AT&T dsl; Westell 327w modem/router; SuSE 10.1; firefox 2.0.0.13
	to forum · permalink · · 2008-04-01 12:37:04 ·
EGeezer Summer is passing Premium join:2002-08-04 Country! ·RoadRunner Cable ·AT&T CallVantage	Ah, no problem :) the Caching proxy server will simply pass the entire encapsulated request. 3.0 FEP Protocol Figure 1 shows a high level view of our protocol. The application (1) in host A (outside the Firewall) sends a TCP/IP datagram to host B (within the firewall). Using a tunnel interface the TCP/IP datagram is routed to our FEP software (2), which encodes the datagram within a HTTP message. Then this message is sent via a HTTP/TCP/IP tunnel (3) to host B on the normal HTTP port (4). When it arrives at host B, this packet is routed via the tunnel to the FEP software (5), which decodes the packet and creates a TCP/IP datagram to insert into host's B protocol stack (6). This packet is routed to the application on host B (7), as if the Firewall (8) never existed. Gaynor & Bradner Informational [Page 3] RFC 3093 Firewall Enhancement Protocol 1 April 2001 host A host B ---------- ---------- \| App \| (1) \| App \| (7) \|----------\| \|----------\| \| TCP \| \| TCP \| \|----------\| \|----------\| \| IP \| \| IP \| (6) \|----------\| \|----------\| \| FEP dvr \| (2) \| FEP dvr \| (5) \|----------\| \|----------\| \| TCP \| \| TCP \| \|----------\| \|----------\| \| IP \| Firewall (8) \| IP \| ---------- --- ----------- \| (3) \| \| ^ (4) +---------------->\| \|-----------------------+ \| \| \| \| --- Figure 1 3.1 HTTP Method FEP allows either side to look like a client or server. Each TCP/IP packet is sent as either a HTTP GET request or a response to a GET request. This flexibility work well with firewalls that try to verify valid HTTP commands crossing the Firewall stopping the unwanted intercepting of FEP packets. -- Mayors of New York come from nowhere and go nowhere. Wallace Sayre (apparently, so do governors... )
	to forum · permalink · · 2008-04-01 12:53:07 ·


Monday, 13-Oct 16:02:01	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 9 years online! © 1999-2008 dslreports.com.republican-creole page compression OFF